https://github.com/osquery/osquery logo
Title
t

Ted Dorosheff

01/22/2022, 2:46 PM
Now i've also experimented with different wildcards for my path in
file_paths
. have tried all listed variants: C:\Windows\Temp\ <- should monitor for changes to files/directories within Temp C:\Windows\Temp\% <- same as above C:\Windows\Temp\%% <- monitor for changes to files/directories recursively within Temp Is my logic on the wildcards correct?
z

zwass

01/22/2022, 5:10 PM
I'm no expert on our FIM configs, but I think if you don't have the trailing % then you would just be monitoring the temp dir itself and not the contents.